Linux Permission Troubleshooting
The objective is diagnosis, not syntax. A real denial is created three directories above the file that cannot be read, and then found with namei -l - which prints the permissions of every component of a path at once and points straight at the one that blocks. The other three usual causes are ruled in and out the same way.
File Systems Guide 41 of 67 Intermediate
- OSRHEL 10.0
- Kernel6.12.0-55.9.1.el10_0
- dnf4.20.0
- Flatpak1.16.0
- TimeAbout 14 min
There are four things that deny access and only the first shows in ls -l on the file: the file's own mode, a directory in its path, an ACL (marked by a +), and the SELinux label (invisible without -Z). Checking them in that order is the whole method.
| Server Name | IP Address | OS | Roles | CPU | RAM | HDD |
|---|---|---|---|---|---|---|
| RHCSA-A01 | 192.168.0.31 | RHEL 10.0 | Practice node (graded) - spare /dev/sda | 2 Core | 4 GB | 50 GB + 15 GB |
This guide includes
Use this because the objective is diagnosis rather than syntax. This matters because a denial can come from anywhere along a path - and namei -l finds it in one command instead of four separate guesses.
- meeting a denial with no obvious cause
- finding it in one command with
namei -l - checking the other three suspects
- spotting an ACL, where the
+is the only clue you are given
Before you start
- A sudo-capable account.
- The session creates two users, a group and
/srv/proj, and removes them all.
-
A denial with no obvious cause
-
`namei -l` finds it in one command
-
The other three suspects
-
ACLs, and the `+` that is the only clue